IP Logging Help

[Mistah_Roth]

I made a voting script, where when you click a link to vote for a certain field, it sets a vote variable to the ID number of the field, and then submits the vote. The actual voting works, but I am trying to make it so it logs the IPs, and then sets a "time" column to 1 until 24 hours later, making it so all IPs with the variable 1 cannot vote, here is my code:

if ($vote != ""){
	$ip = getenv('REMOTE_ADDR'); 
		if ($getip=mysql_query("SELECT time FROM ip_logs WHERE ip=$ip"))
		{
			if ($getip['time']==1){	
			$voterip = 1;
			}
			if ($getip['time']==0){
			mysql_query ("UPDATE top_requests SET requests=requests+1 WHERE ID=$vote", $db);
			}
		}
		else {
			mysql_query ("INSERT INTO ip_logs (ip,time) VALUES ('$ip', 1)", $db);
			mysql_query ("UPDATE top_requests SET requests=requests+1 WHERE ID=$vote", $db);
			}
	}

When my IP is logged, and I try voting again, it logs my IP each time but doesnt find the IP thats already there, it just keeps letting me vote over and over and my IP gets logged many different times. Can anyone help me by telling me whats wrong with my code?

[Pig]

You need to extract the data from the result, or change the query. You could handle the qualification in the query like this (assuming you are using a unix timestamp):
$result = mysql_query("SELECT * FROM ip_logs WHERE ip=$ip AND time <= " . strtotime("now -24 hours") );
Then you just check the number of rows returned by the query. 0 rows = OK. 1 row = already voted.

If you don't want to do it that way, then you at least need to do a mysql_fetch_assoc() on the $result.

[Pig]

Also, your whole time scheme is messed up. You cant track time if all you ever insert is "1". Everything will be one. You need to track an actual moment.

Change time to a varchar if it isn't already, and store timestamps there instead.

if( !empty($vote) )
{
     $result = mysql_query("SELECT * FROM ip_logs WHERE ip=$ip AND time <= " . strtotime("now -24 hours") );
     if( mysql_num_rows($result) > 0 ) echo("You have already voted.");
     else
     {
          mysql_query ("INSERT INTO ip_logs (ip,time) VALUES ('$ip', " . time() . ")", $db); 
          mysql_query ("UPDATE top_requests SET requests=requests+1 WHERE ID=$vote", $db); 
     }
}

[Mistah_Roth]

Thanks for your help, im pretty new to PHP and MySQL so I am still learning.... I understand what you changed and it makes sense to me, except that the mysql_num_rows seems to not be working, I get this error:

Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/virtual/site1/fst/var/www/html/vote.php on line 12

line 12 being:

if (mysql_num_rows($result) > 0) {

[drawmack]

I wouldn't use the IP for this, it's too easy to spoof and many people have dynamic IPs. You're better off to just set a cookie that expires in one day and do not register the vote until the cookie is set. Something like this

page 1) display the survay
page 2) confirm the answer or yell at them to turn cookies on. (just set the cookie then refresh to self and try to read the cookie)

page 3) registers the vote and says thank you.

[Mistah_Roth]

haha yes well as you can see I am a noob and don't have the slightest clue how to use cookies or how they work, I supposed I will learn eventually and I can upgrade this script, but right now I just need something to work...

And BTW, I changed the query to this:

$result = mysql_query("SELECT * FROM ip_logs WHERE ip=$ip AND time <= " . strtotime("now -24 hours") ) or die(mysql_error());

and got this:

You have an error in your SQL syntax near '.111.137 AND time <= 1066538130' at line 1

[LordShryku]

You need single quotes

$result = mysql_query("SELECT *
                       FROM   ip_logs
                       WHERE  ip='".$ip."'
                       AND    time <= ".strtotime("now -24 hours"))
          or die(mysql_error());

[Pig]

sorry, my bad.

[LordShryku]

Simple mistake. I still do it all the time. Just always seems easier when I'm looking at someone else's code

[Mistah_Roth]

Alright thanks, the error is gone but the problem still isnt solved, still lets me vote as many times as I want...

Could it be the type of variable ip is? I have it set to varchar should it be something else?

[Pig]

Are you updating the table as well? Can you post your entire code?

[Mistah_Roth]

<?php 

include $root_relative_path.'dbinfo.php';

if (!empty($vote)) { 
	$ip = getenv('REMOTE_ADDR');
 	$result = mysql_query("SELECT * FROM   ip_logs WHERE  ip='".$ip."' AND    time <= ".strtotime("now -24 hours")) or die(mysql_error());
	if ( mysql_num_rows($result) > 0 ) {
	$voterip = 1;
	$message = "Sorry but you have already voted today, try again tommorow";
	}
	else { 
      mysql_query ("INSERT INTO ip_logs (ip,time) VALUES ('$ip', " . time() . ")", $db);  
      mysql_query ("UPDATE top_requests SET requests=requests+1 WHERE ID=$vote", $db); 
	  $message = "Thank you for Voting, You will now be redirected to the voting page"; 
 	} 
}

?>

[LordShryku]

Try splitting it up and making sure it select the right thing. Run it against phpMyAdmin or whatever DB interface you use to make sure results should be found

$sql = "SELECT *
        FROM   ip_logs
        WHERE  ip ='".$ip."'
        AND    time <= ".strtotime("now -24 hours")";
   echo $sql;

[Mistah_Roth]

The echos shows this:

SELECT * FROM ip_logs WHERE ip ='67.70.172.135' AND time <= 1066599537

WHen I try that query in phpadmin it returns nothing, but if I get rid of the AND time <= 1066599537 it works... I tried taking that part out and the script works now, should i leave it without it or change it?

Also, what query can I run that will delete the entry 24 hours after its been submitted? I am not familiar with any time related functions

[LordShryku]

What kind of field is time setup as? Methinks it's prolly a bigint field. You may want to look at the data that's in there and see why this isn't valid.

If you want to delete them automatically, you could schedule some sort of cron job to run and delete based on timestamp...